Congress mandates cybersecurity for suicide hotline—but won't fund it

What it does

This bill requires the 9-8-8 National Suicide Prevention Lifeline to implement cybersecurity protections and establish a reporting system for security vulnerabilities and incidents. Network administrators and local crisis centers must report cybersecurity problems to federal overseers within a reasonable timeframe, and the Government Accountability Office must study the lifeline's cybersecurity risks within 180 days.

Why we flagged it

The bill's core function is to impose cybersecurity standards and incident-reporting obligations on a federally funded suicide prevention service. It is a regulatory requirement, not a subsidy or deregulation.

What the text implies

• The phrase 'reasonable amount of time' for reporting vulnerabilities and incidents is undefined, potentially allowing delays that could leave the hotline exposed or callers' data at risk.
• The bill does not specify funding for cybersecurity improvements, only reporting requirements—crisis centers may lack resources to actually fix vulnerabilities they are required to report.
• Oversight responsibility is split between network administrators and local crisis centers with ambiguous boundaries ('if such oversight responsibilities are established in the applicable network participation agreement'), which may create gaps in accountability.
• The 180-day GAO study may arrive too late to inform immediate security fixes if vulnerabilities are discovered before the report is completed.

Who it affects

Ordinary people using a suicide prevention hotline gain stronger protections against data breaches and service disruptions that could compromise their privacy or prevent them from reaching help in crisis. The reporting requirements create accountability and transparency around security failures.

Who stands to gain

• cybersecurity consulting firms
• network security software vendors
• IT infrastructure providers

Named in the bill

9-8-8 National Suicide Prevention Lifeline, Public Health Service Act, Assistant Secretary (HHS), Comptroller General, Senate Committee on Health, Education, Labor, and Pensions, House Committee on Energy and Commerce, local and regional crisis centers, network administrators

Where it stands

3 cosponsors: 3 Democrats.

• Feb 4, 2025 — Introduced · Congress.gov: “Introduced in House”
• Feb 4, 2025 — Referred to House Committee on Energy and Commerce · Congress.gov: “Referred to the House Committee on Energy and Commerce”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

4 lobbying clients named this bill on 6 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $989,365 in lobbying spend. A filing names 52 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 72% of bills with at least one filing.

Jay Obernolte, the sponsor, reported $976,024 in PAC receipts in the 2026 cycle.

• American Psychiatric Association — $529,365 on 2 filings
• American Psychological Association Services Inc.(fka American Psychological Assn — $340,000 on 1 filing
• Mental Health Association of New York City, Inc. (dba Vibrant Emotional Health) — $100,000 on 2 filings
• National Alliance on Mental Illness — $20,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.